There are a number of ways that this could be done.. sms is just one ways it could be implemented. my work vpn provides this capability by allowing me to run software (RSA soft token) on my machine that would generate the code or a hard token that I could carry with me. The general idea is to provide 2 pieces of information.. something you know, your password... and something you have.. (cell phone, token or can generate via an application).